Wordfence Intelligence Weekly WordPress Vulnerability Report (October 21, 2024 to October 27, 2024)
🦸 👻 Calling all superheroes and haunters! Introducing the Cybersecurity Month Spooktacular Haunt and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program! Through November 11th, 2024:
- All in-scope vulnerability types for WordPress plugins/themes with >= 1,000 active installations are in-scope for ALL researchers
- Top-tier researchers earn automatic bonuses of between 10% to 120% for valid submissions
- Pending report limits are increased for all
- It’s possible to earn up to $31,200 for high impact vulnerabilities!
Last week, there were 241 vulnerabilities disclosed in 210 WordPress Plugins and 7 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 58 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 19,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- WAF-RULE-757 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-758 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 154 |
| Unpatched | 87 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 171 |
| High Severity | 37 |
| Critical Severity | 33 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 119 |
| Missing Authorization | 39 |
| Unrestricted Upload of File with Dangerous Type | 18 |
| Authentication Bypass Using an Alternate Path or Channel | 13 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 9 |
| Cross-Site Request Forgery (CSRF) | 8 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 8 |
| Exposure of Sensitive Information to an Unauthorized Actor | 7 |
| Improper Control of Generation of Code ('Code Injection') | 5 |
| Deserialization of Untrusted Data | 3 |
| Improper Authentication | 2 |
| Improper Authorization | 2 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 2 |
| URL Redirection to Untrusted Site ('Open Redirect') | 2 |
| Authorization Bypass Through User-Controlled Key | 1 |
| Improper Restriction of XML External Entity Reference | 1 |
| Incorrect Privilege Assignment | 1 |
| Weak Password Recovery Mechanism for Forgotten Password | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 25 | |
| 23 | |
| 22 | |
| 22 | |
| 13 | |
| 11 | |
| 8 | |
| 8 | |
| 8 | |
| 7 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| 1-Click Login: Passwordless Authentication | swoop-password-free-authentication |
| 10Web Social Post Feed | wd-facebook-feed |
| 3D Work In Progress | renee-work-in-progress |
| ACL Floating Cart for WooCommerce | acl-floating-cart-for-woocommerce |
| Acnoo Flutter API | acnoo-flutter-api |
| aDirectory – WP Business Directory Plugin and Classified Ads Listings Directory | adirectory |
| Adminify – White Label, Admin Menu Editor, Login Customizer | adminify |
| Ads.txt & App-ads.txt Manager for WordPress | app-ads-txt |
| Advanced Online Ordering and Delivery Platform | advanced-online-ordering-and-delivery-platform |
| Advanced Sermons | advanced-sermons |
| Affiliate Platform | smdp-affiliate-platform |
| AffiliateX – Amazon Affiliate Plugin, Product Boxes, Comparison Tables & Affiliate Link Tracking | affiliatex |
| Agile Video Player Lite | agile-video-player |
| AI Image Generator for Your Content & Featured Images – AI Postpix | ai-postpix |
| AidWP – Donation & Payment Forms (Stripe Powered) | wp-stripe-donation |
| Ajar in5 Embed | ajar-productions-in5-embed |
| All-in-One WP Migration and Backup | all-in-one-wp-migration |
| Amilia Store | amilia-store |
| AMP for WP – Accelerated Mobile Pages | accelerated-mobile-pages |
| Anchor Episodes Index (Spotify for Podcasters) | anchor-episodes-index |
| App Builder – Create Native Android & iOS Apps On The Flight | app-builder |
| AR for WordPress | ar-for-wordpress |
| Astra Widgets | astra-widgets |
| Auto Login using a secure tokenized url. Role wise login restriction. | token-login |
| Automatic Translation | automatic-translation |
| Awesome buttons | wp-awesome-buttons |
| Backup and Staging by WP Time Capsule | wp-time-capsule |
| Bamazoo – Button Generator | bamazoo-button-generator |
| Banner Slider | banner-slider |
| Beaver Builder Page Builder – Drag and Drop Website Builder | beaver-builder-lite-version |
| Beek Widget Extention | beek-widget-extention |
| Bet WC 2018 Russia | bet-wc-2018-russia |
| Bold Page Builder | bold-page-builder |
| BP Member Type Manager | bp-member-type-manager |
| Breeze Cache | breeze |
| Bstone Demo Importer | bstone-demo-importer |
| BuddyPress | buddypress |
| BuddyPress Greeting Message | bp-greeting-message |
| Buttonizer – Live Chat, AI Chatbot, Call, Chat, Contact Button | button-contact-vr |
| Campus Explorer Widget | campus-explorer-widget |
| Category and Taxonomy Image | wp-custom-taxonomy-image |
| Category and Taxonomy Meta Fields | wp-custom-taxonomy-meta |
| chatplusjp | chatplusjp |
| Church Admin | church-admin |
| Classified Listing – AI-Powered Classified ads & Business Directory | classified-listing |
| Clever Addons for Elementor | cafe-lite |
| Client Power Tools Portal | client-power-tools |
| Code Generate | code-generator |
| CodePen Embedded Pens Shortcode | codepen-embedded-pen-shortcode |
| Comments – wpDiscuz | wpdiscuz |
| Compact WP Audio Player | compact-wp-audio-player |
| Conditional Fields for Contact Form 7 | cf7-conditional-fields |
| Contact Form 7 – Repeatable Fields | cf7-repeatable-fields |
| Coub | coub |
| Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates | cozy-addons |
| Custom Icons for Elementor | custom-icons-for-elementor |
| Custom Twitter Feeds – A Tweets Widget or X Feed Widget | custom-twitter-feeds |
| CWD 3D Image Gallery | cwd-3d-image-gallery |
| DarkMySite – Advanced Dark Mode Plugin for WordPress | darkmysite |
| DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer | 3d-flipbook-dflip-lite |
| DocumentPress | documentpress-display-any-document-on-your-site |
| Download Monitor | download-monitor |
| Download Plugin | download-plugin |
| Editor Custom Color Palette | editor-custom-color-palette |
| Editorial Assistant by Sovrn | zemanta |
| EKC Tournament Manager | ekc-tournament-manager |
| ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor | elementskit-lite |
| EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents | embedpress |
| Envo's Templates & Widgets for Elementor and WooCommerce | envo-elementor-for-woocommerce |
| ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce | erp |
| Event Booking Manager for WooCommerce – Registration, RSVP, Calendar & Tickets | mage-eventpress |
| EventPrime – Events Calendar, Bookings and Tickets | eventprime-event-calendar-management |
| Exam Matrix | exam-matrix |
| Extensions by HocWP Team | sb-core |
| Extra Privacy for Elementor | extra-privacy-for-elementor |
| Extra Product Options Builder for WooCommerce | additional-product-fields-for-woocommerce |
| File Upload Types by WPForms | file-upload-types |
| Firelight Lightbox | easy-fancybox |
| FormFacade – Embed Google Forms in your website | formfacade |
| Forminator Forms – Contact Form, Payment Form & Custom Form Builder | forminator |
| Forms for Mailchimp by Optin Cat – Grow Your MailChimp List | mailchimp-wp |
| FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce | wp-marketing-automations |
| Futurio Extra | futurio-extra |
| GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | geodirectory |
| Google Docs RSVP, WordPress Plugin | google-docs-rsvp-guestlist |
| Great Restaurant Menu WP | best-restaurant-menu-by-pricelisto |
| Greenshift – animation and page builder blocks | greenshift-animation-and-page-builder-blocks |
| GRÜN spendino Spendenformular – Mehr Spenden! Weniger Arbeit! | spendino |
| HD Quiz – Save Results Light | hd-quiz-save-results-light |
| HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce | hurrytimer |
| ID-SK Toolkit | idsk-toolkit |
| Image Map Pro – Drag-and-drop Builder for Interactive Images | image-map-pro |
| Import and export users and customers | import-users-from-csv-with-meta |
| INK Official | ink-official |
| Interactive World Map | interactive-world-map |
| Kata Plus – Addons for Elementor – Widgets, Extensions and Templates | kata-plus |
| Kodex Posts likes | kodex-posts-likes |
| Landing Page Cat – Coming Soon & Maintenance Pages | landing-page-cat |
| LaTeX2HTML | latex2html |
| League of Legends Shortcodes | league-of-legends-shortcodes |
| leenk.me | leenkme |
| Local Business Addons For Elementor (Formally Waze Map) | map-addons-for-elementor-waze-map |
| MaanStore API | maanstore-api |
| Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid | magazine-blocks |
| Mapster WP Maps | mapster-wp-maps |
| Marketing Automation by AZEXO | marketing-automation-by-azexo |
| MDTF – Meta Data and Taxonomies Filter | wp-meta-data-filter-and-taxonomy-filter |
| Meetup | meetup |
| Mega Elements – Addons for Elementor | mega-elements-addons-for-elementor |
| Message Bridge for Contact Form 7 and Telegram | cf7-telegram |
| Monitor.chat – Monitor WordPress with Instant Messages | monitor-chat |
| Monkee-Boy Essentials | monkee-boy-wp-essentials |
| Multi Purpose Mail Form | multi-purpose-mail-form |
| Multi Step Form | multi-step-form |
| MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions | dc-woocommerce-multi-vendor |
| My Wp Brand – Hide menu & Hide Plugin | my-wp-brand |
| myCred for Elementor | mycred-for-elementor |
| Namaste! LMS | namaste-lms |
| News Kit Addons For Elementor | news-kit-elementor-addons |
| Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder | the-plus-addons-for-block-editor |
| Order Notification for Telegram | order-notification-for-telegram |
| PDF Generator for WordPress Elementor | pdf-generator-addon-for-elementor-page-builder |
| PDF Invoices & Packing Slips for WooCommerce | woocommerce-pdf-invoices-packing-slips |
| PegaPoll | pegapoll |
| Plugin Name: iBryl Switch User | ibryl-switch-user |
| Plugin Propagator | wp-propagator |
| Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls | poll-maker |
| Portfolleo | portfolleo |
| Post Grid | post-grid |
| Post Grid Gutenberg Blocks – PostX | ultimate-post |
| Premium SEO Pack – WP SEO Plugin | premium-seo-pack |
| PriPre | pripre |
| Product Filter for WooCommerce by WBW | woo-product-filter |
| ProfilePress Pro | profilepress-pro |
| Qi Addons For Elementor | qi-addons-for-elementor |
| Qi Blocks | qi-blocks |
| Qode Essential Addons | qode-essential-addons |
| Raptor Editor | wp-raptor |
| Realty Workstation | realty-workstation |
| Risk Warning Bar | risk-warning-bar |
| Robo Gallery – Photo & Image Slider | robo-gallery |
| Rover IDX | rover-idx |
| Royal Addons for Elementor – Addons and Templates Kit for Elementor | royal-elementor-addons |
| RSS Feed Widget | rss-feed-widget |
| RSVP ME | rsvp-me |
| Schema & Structured Data for WP & AMP | schema-and-structured-data-for-wp |
| School Management System – WPSchoolPress | wpschoolpress |
| Scrollbar by webxapp – Best vertical/horizontal scrollbars plugin | scrollbar-by-webxapp |
| Selection Lite | selection-lite |
| SEOPress – AI SEO Plugin & On-site SEO | wp-seopress |
| Shipping Live Rates and Access Points for UPS for WooCommerce | flexible-shipping-ups |
| Shortcodes Ultimate – Content Elements | shortcodes-ultimate |
| Shoutcast Icecast HTML5 Radio Player | shoutcast-icecast-html5-radio-player |
| Signup Page | signup-page |
| Simple Custom Admin | simple-custom-admin |
| Simple Load More | simple-load-more |
| Simple Membership | simple-membership |
| Simple News | simple-news |
| Sky Addons for Elementor | sky-elementor-addons |
| Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management | smart-manager-for-wp-e-commerce |
| Stacks Mobile App Builder – The most powerful Mobile Applications Drag and Drop builder | stacks-mobile-app-builder |
| Sudan Payment Gateway for WooCommerce | wc-sudan-payment-gateway |
| Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers | sunshine-photo-cart |
| Survey Maker by AYS | survey-maker |
| SurveyJS: Drag & Drop Form Builder | surveyjs |
| SVG Captcha | svg-captcha |
| Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! | templately |
| TeploBot – Telegram Bot for WP | green-wp-telegram-bot-by-teplitsa |
| Terms descriptions | terms-descriptions |
| Textboxes | textboxes |
| The Pack Elementor addon | the-pack-addon |
| Themes4WP YouTube External Subtitles | themes4wp-youtube-external-subtitles |
| Tida URL Screenshot | tida-url-screenshot |
| Time Slot – Booking and Appointment System | timeslot |
| Todo Custom Field | todo-custom-field |
| Transients Manager | transients-manager |
| TripPlan | tripplan |
| uCAT – Next Story | ucat-next-story |
| Uix Shortcodes | uix-shortcodes |
| Ultimate Addons for Elementor | header-footer-elementor |
| User Toolkit | user-toolkit |
| Verbalize WP | verbalize-wp |
| WatchTowerHQ | watchtowerhq |
| Web Bricks Addons for Elementor: Elite-Designed Elementor & eCommerce Widgets | webbricks-addons |
| Whitelist | fifthsegment-whitelist |
| Woocommerce Custom Profile Picture | woo-custom-profile-picture |
| WooCommerce Maintenance Mode (Free) | woocommerce-maintenance-mode |
| WooCommerce Order Proposal | wooCommerce-order-proposal |
| Woocommerce Product Design | woo-product-design |
| Woocommerce Quote Calculator | woo-quote-calculator-order |
| WordPress eCommerce – ScottCart | scottcart |
| WordPress Post Grid Layouts with Pagination – Sogrid | sogrid |
| WP Abstracts | wp-abstracts-manuscripts-manager |
| WP Awesome Login | wp-awesome-login |
| WP Booking System – Booking Calendar | wp-booking-system |
| WP Crowdfunding | wp-crowdfunding |
| WP Flow Plus | wp-imageflow2 |
| WP Query Console | wp-query-console |
| WP Recipe Maker | wp-recipe-maker |
| WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content | wp-rss-aggregator |
| WP Sessions Time Monitoring Full Automatic | activitytime |
| WP show more | wp-show-more |
| Wp Social Login and Register Social Counter | wp-social |
| WP VR – 360 Panorama and Virtual Tour Builder | wpvr |
| WP-Members Membership Plugin | wp-members |
| WPC Shop as a Customer for WooCommerce | wpc-shop-as-customer |
| WPKoi Templates for Elementor | wpkoi-templates-for-elementor |
| WPS Telegram Chat | wps-telegram-chat |
| Wux Blog Editor | wux-blog-editor |
| YITH WooCommerce Product Add-Ons | yith-woocommerce-product-add-ons |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Clean Retina | clean-retina |
| Flatsome | flatsome |
| Js Paper | js-paper |
| Mags | mags |
| Meta News | meta-news |
| NewsCard | newscard |
| Nioland - SaaS & Software Startup Tech WordPress Theme | nioland |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
1-Click Login: Passwordless Authentication [swoop-password-free-authentication]
Researcher
Affected Software
Acnoo Flutter API [acnoo-flutter-api]
Researcher
Affected Software
Researcher
Affected Software
Advanced Online Ordering and Delivery Platform [advanced-online-ordering-and-delivery-platform]
Researcher
Affected Software
Ajar in5 Embed [ajar-productions-in5-embed]
Researcher
Affected Software
AR for WordPress [ar-for-wordpress]
Researcher
Affected Software
Automatic Translation [automatic-translation]
Researcher
Affected Software
Clean Retina [clean-retina]
Researcher
Affected Software
Comments – wpDiscuz [wpdiscuz]
Researcher
Affected Software
Exam Matrix [exam-matrix]
Researcher
Affected Software
Extensions by HocWP Team [sb-core]
Researcher
Affected Software
Researcher
Affected Software
MaanStore API [maanstore-api]
Researcher
Affected Software
Mags [mags]
Researcher
Affected Software
Meta News [meta-news]
Researcher
Affected Software
Multi Purpose Mail Form [multi-purpose-mail-form]
Researcher
Affected Software
NewsCard [newscard]
Researcher
Affected Software
PegaPoll [pegapoll]
Researcher
Affected Software
Plugin Propagator [wp-propagator]
Researcher
Affected Software
Realty Workstation [realty-workstation]
Researcher
Affected Software
WordPress eCommerce – ScottCart [scottcart]
Researcher
Affected Software
Signup Page [signup-page]
Researcher
Affected Software
Stacks Mobile App Builder – The most powerful Mobile Applications Drag and Drop builder [stacks-mobile-app-builder]
Researcher
Affected Software
Sudan Payment Gateway for WooCommerce [wc-sudan-payment-gateway]
Researcher
Affected Software
Verbalize WP [verbalize-wp]
Researcher
WatchTowerHQ <= 3.10.1 - Authentication Bypass to Administrator due to Missing Empty Value Check
9.8
Affected Software
WatchTowerHQ [watchtowerhq]
Researcher
Affected Software
Woocommerce Custom Profile Picture [woo-custom-profile-picture]
Researcher
Affected Software
Woocommerce Product Design [woo-product-design]
Researcher
Affected Software
WP Query Console [wp-query-console]
Researcher
Affected Software
Wp Social Login and Register Social Counter [wp-social]
Researcher
Affected Software
Wux Blog Editor [wux-blog-editor]
Researcher
Affected Software
Wux Blog Editor [wux-blog-editor]
Researcher
Affected Software
3D Work In Progress [renee-work-in-progress]
Researcher
Affected Software
3D Work In Progress [renee-work-in-progress]
Researcher
Affected Software
Researcher
Affected Software
AMP for WP – Accelerated Mobile Pages [accelerated-mobile-pages]
Researcher
Affected Software
Bstone Demo Importer [bstone-demo-importer]
Researcher
Affected Software
EKC Tournament Manager [ekc-tournament-manager]
Researcher
iBryl Switch User <= 1.0.1 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
8.8
Affected Software
Plugin Name: iBryl Switch User [ibryl-switch-user]
Researcher
Affected Software
INK Official [ink-official]
Researcher
Affected Software
Mapster WP Maps [mapster-wp-maps]
Researcher
Affected Software
Marketing Automation by AZEXO [marketing-automation-by-azexo]
Researcher
Affected Software
Namaste! LMS [namaste-lms]
Researcher
Affected Software
Portfolleo [portfolleo]
Researcher
Affected Software
Qi Blocks [qi-blocks]
Researcher
Affected Software
Qode Essential Addons [qode-essential-addons]
Researcher
Affected Software
Rover IDX [rover-idx]
Researcher
Affected Software
School Management System – WPSchoolPress [wpschoolpress]
Researcher
Affected Software
SurveyJS: Drag & Drop Form Builder [surveyjs]
Researcher
Affected Software
The Pack Elementor addon [the-pack-addon]
Researcher
Affected Software
Researcher
Affected Software
User Toolkit [user-toolkit]
Researcher
WPC Shop as a Customer for WooCommerce <= 1.2.6 - Authenticated (Subscriber+) PHP Object Injection
8.8
Affected Software
WPC Shop as a Customer for WooCommerce [wpc-shop-as-customer]
Researcher
Affected Software
TeploBot – Telegram Bot for WP [green-wp-telegram-bot-by-teplitsa]
Researcher
Affected Software
Researcher
Affected Software
BuddyPress [buddypress]
Researcher
Affected Software
ProfilePress Pro [profilepress-pro]
Researcher
Affected Software
Researcher
Affected Software
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce [wp-marketing-automations]
Researcher
Affected Software
RSVP ME [rsvp-me]
Researcher
Affected Software
Woocommerce Quote Calculator [woo-quote-calculator-order]
Researcher
Affected Software
WP Sessions Time Monitoring Full Automatic [activitytime]
Researcher
Affected Software
Uix Shortcodes [uix-shortcodes]
Researcher
Affected Software
MDTF – Meta Data and Taxonomies Filter [wp-meta-data-filter-and-taxonomy-filter]
Researcher
Affected Software
All-in-One WP Migration and Backup [all-in-one-wp-migration]
Researcher
Affected Software
Backup and Staging by WP Time Capsule [wp-time-capsule]
Researcher
Affected Software
Custom Icons for Elementor [custom-icons-for-elementor]
Researcher
Affected Software
WooCommerce Order Proposal [wooCommerce-order-proposal]
Researcher
Affected Software
Researcher
Affected Software
Download Plugin [download-plugin]
Researchers
League of Legends Shortcodes <= 1.0.1 - Authenticated (Contributor+) SQL Injection via Shortcode
6.5
Affected Software
League of Legends Shortcodes [league-of-legends-shortcodes]
Researcher
Affected Software
Premium SEO Pack – WP SEO Plugin [premium-seo-pack]
Researcher
Affected Software
WP Recipe Maker [wp-recipe-maker]
Researcher
Affected Software
Advanced Sermons [advanced-sermons]
Researcher
Affected Software
Researcher
Affected Software
Amilia Store [amilia-store]
Researcher
Affected Software
Anchor Episodes Index (Spotify for Podcasters) [anchor-episodes-index]
Researcher
Affected Software
Astra Widgets [astra-widgets]
Researcher
Awesome buttons <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via btn2 Shortcode
6.4
Affected Software
Awesome buttons [wp-awesome-buttons]
Researcher
Affected Software
Bamazoo – Button Generator [bamazoo-button-generator]
Researcher
Affected Software
Beaver Builder Page Builder – Drag and Drop Website Builder [beaver-builder-lite-version]
Researcher
Affected Software
Beek Widget Extention [beek-widget-extention]
Researcher
CodePen Embedded Pens Shortcode <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
CodePen Embedded Pens Shortcode [codepen-embedded-pen-shortcode]
Researcher
Affected Software
Compact WP Audio Player [compact-wp-audio-player]
Researcher
Affected Software
Contact Form 7 – Repeatable Fields [cf7-repeatable-fields]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Editor Custom Color Palette [editor-custom-color-palette]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Envo's Templates & Widgets for Elementor and WooCommerce [envo-elementor-for-woocommerce]
Researcher
Event Manager for WooCommerce <= 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Researcher
Affected Software
File Upload Types by WPForms [file-upload-types]
Researcher
Affected Software
Firelight Lightbox [easy-fancybox]
Researcher
Affected Software
Futurio Extra [futurio-extra]
Researcher
Affected Software
Researcher
ID-SK Toolkit <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
6.4
Affected Software
ID-SK Toolkit [idsk-toolkit]
Researcher
Affected Software
Image Map Pro – Drag-and-drop Builder for Interactive Images [image-map-pro]
Researcher
Affected Software
Interactive World Map [interactive-world-map]
Researcher
Affected Software
Researcher
Affected Software
Kodex Posts likes [kodex-posts-likes]
Researcher
Affected Software
League of Legends Shortcodes [league-of-legends-shortcodes]
Researcher
Affected Software
Local Business Addons For Elementor (Formally Waze Map) [map-addons-for-elementor-waze-map]
Researcher
Affected Software
Researcher
Affected Software
Mega Elements – Addons for Elementor [mega-elements-addons-for-elementor]
Researcher
Affected Software
Monkee-Boy Essentials [monkee-boy-wp-essentials]
Researcher
Affected Software
myCred for Elementor [mycred-for-elementor]
Researcher
Affected Software
Namaste! LMS [namaste-lms]
Researcher
Affected Software
Namaste! LMS [namaste-lms]
Researcher
Affected Software
Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder [the-plus-addons-for-block-editor]
Researcher
Affected Software
PDF Generator for WordPress Elementor [pdf-generator-addon-for-elementor-page-builder]
Researcher
Post Grid and Gutenberg Blocks <= 2.2.93 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Post Grid [post-grid]
Researcher
Affected Software
Post Grid Gutenberg Blocks – PostX [ultimate-post]
Researcher
Affected Software
PriPre [pripre]
Researcher
Affected Software
Raptor Editor [wp-raptor]
Researcher
Affected Software
Robo Gallery – Photo & Image Slider [robo-gallery]
Researcher
Affected Software
RSS Feed Widget [rss-feed-widget]
Researcher
Affected Software
Scrollbar by webxapp – Best vertical/horizontal scrollbars plugin [scrollbar-by-webxapp]
Researcher
Affected Software
Selection Lite [selection-lite]
Researcher
Affected Software
Shoutcast Icecast HTML5 Radio Player [shoutcast-icecast-html5-radio-player]
Researcher
Simple News <= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via news Shortcode
6.4
Affected Software
Simple News [simple-news]
Researcher
Affected Software
Sky Addons for Elementor [sky-elementor-addons]
Researcher
Affected Software
Themes4WP YouTube External Subtitles [themes4wp-youtube-external-subtitles]
Researcher
Affected Software
Time Slot – Booking and Appointment System [timeslot]
Researcher
Web Bricks Addons for Elementor <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Researcher
Affected Software
MDTF – Meta Data and Taxonomies Filter [wp-meta-data-filter-and-taxonomy-filter]
Researcher
Affected Software
Researcher
WP Awesome Login <= 0.4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
6.4
Affected Software
WP Awesome Login [wp-awesome-login]
Researcher
Affected Software
WP Crowdfunding [wp-crowdfunding]
Researcher
Affected Software
WP Flow Plus [wp-imageflow2]
Researcher
Affected Software
WP show more [wp-show-more]
Researcher
Affected Software
WP-Members Membership Plugin [wp-members]
Researcher
WPKoi Templates for Elementor <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
WPKoi Templates for Elementor [wpkoi-templates-for-elementor]
Researcher
Affected Software
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor]
Researcher
Rover IDX <= 3.0.0.2903 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions
6.3
Affected Software
Rover IDX [rover-idx]
Researcher
Affected Software
Researcher
WPS Telegram Chat <= 4.6.0 - Authenticated (Subscriber+) Unauthorized Access to Telegram Bot API
6.3
Affected Software
WPS Telegram Chat [wps-telegram-chat]
Researcher
Affected Software
10Web Social Post Feed [wd-facebook-feed]
Researcher
Affected Software
ACL Floating Cart for WooCommerce [acl-floating-cart-for-woocommerce]
Researcher
Affected Software
Affiliate Platform [smdp-affiliate-platform]
Researcher
Affected Software
Agile Video Player Lite [agile-video-player]
Researcher
Affected Software
Banner Slider [banner-slider]
Researcher
Affected Software
Bet WC 2018 Russia [bet-wc-2018-russia]
Researcher
Affected Software
BP Member Type Manager [bp-member-type-manager]
Researcher
Affected Software
BuddyPress Greeting Message [bp-greeting-message]
Researcher
Affected Software
Campus Explorer Widget [campus-explorer-widget]
Researcher
Affected Software
chatplusjp [chatplusjp]
Researcher
Affected Software
Church Admin [church-admin]
Researcher
Affected Software
Classified Listing – AI-Powered Classified ads & Business Directory [classified-listing]
Researcher
Affected Software
Client Power Tools Portal [client-power-tools]
Researcher
Affected Software
Code Generate [code-generator]
Researcher
Affected Software
CWD 3D Image Gallery [cwd-3d-image-gallery]
Researcher
Affected Software
DocumentPress [documentpress-display-any-document-on-your-site]
Researcher
Affected Software
EventPrime – Events Calendar, Bookings and Tickets [eventprime-event-calendar-management]
Researcher
Affected Software
EventPrime – Events Calendar, Bookings and Tickets [eventprime-event-calendar-management]
Researcher
Affected Software
Extra Privacy for Elementor [extra-privacy-for-elementor]
Researcher
Affected Software
Extra Product Options Builder for WooCommerce [additional-product-fields-for-woocommerce]
Researcher
Affected Software
FormFacade – Embed Google Forms in your website [formfacade]
Researcher
Affected Software
Researcher
Affected Software
Google Docs RSVP, WordPress Plugin [google-docs-rsvp-guestlist]
Researcher
Affected Software
Js Paper [js-paper]
Researcher
Affected Software
LaTeX2HTML [latex2html]
Researcher
Affected Software
leenk.me [leenkme]
Researcher
Affected Software
Monitor.chat – Monitor WordPress with Instant Messages [monitor-chat]
Researcher
Affected Software
Namaste! LMS [namaste-lms]
Researcher
Affected Software
Researcher
Affected Software
DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer [3d-flipbook-dflip-lite]
Researcher
Affected Software
Risk Warning Bar [risk-warning-bar]
Researcher
Affected Software
RSS Feed Widget [rss-feed-widget]
Researcher
Affected Software
Simple Custom Admin [simple-custom-admin]
Researcher
Affected Software
Simple Load More [simple-load-more]
Researcher
Affected Software
Simple Membership [simple-membership]
Researcher
Affected Software
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart]
Researcher
Affected Software
SVG Captcha [svg-captcha]
Researcher
Affected Software
Terms descriptions [terms-descriptions]
Researcher
Affected Software
Tida URL Screenshot [tida-url-screenshot]
Researcher
Affected Software
Todo Custom Field [todo-custom-field]
Researcher
Affected Software
uCAT – Next Story [ucat-next-story]
Researcher
Affected Software
Whitelist [fifthsegment-whitelist]
Researcher
Affected Software
WooCommerce Maintenance Mode (Free) [woocommerce-maintenance-mode]
Researcher
Affected Software
Researcher
Affected Software
WP-Members Membership Plugin [wp-members]
Researcher
Affected Software
YITH WooCommerce Product Add-Ons [yith-woocommerce-product-add-ons]
Researcher
Affected Software
Ads.txt & App-ads.txt Manager for WordPress [app-ads-txt]
Researcher
Affected Software
Buttonizer – Live Chat, AI Chatbot, Call, Chat, Contact Button [button-contact-vr]
Researcher
Affected Software
Category and Taxonomy Image [wp-custom-taxonomy-image]
Researcher
Affected Software
Category and Taxonomy Meta Fields [wp-custom-taxonomy-meta]
Researcher
Category and Taxonomy Meta Fields <= 1.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting
5.5
Affected Software
Category and Taxonomy Meta Fields [wp-custom-taxonomy-meta]
Researcher
Affected Software
Researcher
Category and Taxonomy Meta Fields <= 1.0.0 - Cross-Site Request Forgery to Taxonomy Meta Add/Delete
5.4
Affected Software
Category and Taxonomy Meta Fields [wp-custom-taxonomy-meta]
Researcher
Affected Software
Message Bridge for Contact Form 7 and Telegram [cf7-telegram]
Researcher
Affected Software
Image Map Pro – Drag-and-drop Builder for Interactive Images [image-map-pro]
Researcher
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
Affected Software
Shortcodes Ultimate – Content Elements [shortcodes-ultimate]
Researcher
Affected Software
WPS Telegram Chat [wps-telegram-chat]
Researcher
All-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error Logs
5.3
Affected Software
All-in-One WP Migration and Backup [all-in-one-wp-migration]
Researcher
Affected Software
Breeze Cache [breeze]
Researcher
Affected Software
Flatsome [flatsome]
Researcher
Affected Software
Greenshift – animation and page builder blocks [greenshift-animation-and-page-builder-blocks]
Researcher
Affected Software
Multi Step Form [multi-step-form]
Researcher
Affected Software
Order Notification for Telegram [order-notification-for-telegram]
Researcher
Affected Software
Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp]
Researcher
Affected Software
SEOPress – AI SEO Plugin & On-site SEO [wp-seopress]
Researcher
Affected Software
PDF Invoices & Packing Slips for WooCommerce [woocommerce-pdf-invoices-packing-slips]
Researcher
Affected Software
AidWP – Donation & Payment Forms (Stripe Powered) [wp-stripe-donation]
Researcher
Affected Software
Researcher
Affected Software
Product Filter for WooCommerce by WBW [woo-product-filter]
Researcher
Affected Software
Breeze Cache [breeze]
Researcher
Affected Software
Conditional Fields for Contact Form 7 [cf7-conditional-fields]
Researcher
Affected Software
Import and export users and customers [import-users-from-csv-with-meta]
Researcher
Affected Software
Survey Maker by AYS [survey-maker]
Researcher
Affected Software
WP Abstracts [wp-abstracts-manuscripts-manager]
Researcher
Affected Software
Great Restaurant Menu WP [best-restaurant-menu-by-pricelisto]
Researcher
Affected Software
Bold Page Builder [bold-page-builder]
Researcher
Affected Software
Clever Addons for Elementor [cafe-lite]
Researcher
Affected Software
Custom Twitter Feeds – A Tweets Widget or X Feed Widget [custom-twitter-feeds]
Researcher
Affected Software
Researcher
Affected Software
Download Monitor [download-monitor]
Researcher
Affected Software
Editorial Assistant by Sovrn [zemanta]
Researcher
Affected Software
Ultimate Addons for Elementor [header-footer-elementor]
Researcher
Affected Software
HD Quiz – Save Results Light [hd-quiz-save-results-light]
Researcher
Affected Software
Researcher
Affected Software
Landing Page Cat – Coming Soon & Maintenance Pages [landing-page-cat]
Researcher
Affected Software
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions [dc-woocommerce-multi-vendor]
Researcher
Affected Software
News Kit Addons For Elementor [news-kit-elementor-addons]
Researcher
Affected Software
Qi Addons For Elementor [qi-addons-for-elementor]
Researcher
Affected Software
WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content [wp-rss-aggregator]
Researcher
Affected Software
SEOPress – AI SEO Plugin & On-site SEO [wp-seopress]
Researcher
Affected Software
SEOPress – AI SEO Plugin & On-site SEO [wp-seopress]
Researcher
Affected Software
Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management [smart-manager-for-wp-e-commerce]
Researcher
Affected Software
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart]
Researcher
Affected Software
Researcher
Affected Software
Transients Manager [transients-manager]
Researcher
Affected Software
Shipping Live Rates and Access Points for UPS for WooCommerce [flexible-shipping-ups]
Researcher
Affected Software
WP Booking System – Booking Calendar [wp-booking-system]
Researcher
Affected Software
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments